# Cisco Base Security Configuration

<div id="bkmrk-%23-how-to-use-this-do">\# How to Use This Document</div><div id="bkmrk-">  
</div><div id="bkmrk-this-document-serves">This document serves as a guide for the proper configuration of an ICS IT Cisco Switch. It does not aim to provide users with foundational knowledge of Cisco commands and functions.</div><div id="bkmrk--1">  
</div><div id="bkmrk-the-document-is-divi">The document is divided by configuration code intent used with Cisco IOS switches. The order of the presented code is not intended to indicate the correct implementation sequence, and additional configurations may be necessary from one block to another.</div><div id="bkmrk--2">  
</div><div id="bkmrk-%23%23-procedures">\## Procedures</div><div id="bkmrk--3">  
</div><div id="bkmrk-the-following-code-b">The following code blocks can be implemented in any order after the switch has been booted to the IOS command line. Each code block can also be used independently or to verify an existing configuration.</div><div id="bkmrk--4">  
</div><div id="bkmrk-%23%23-initial-configura">\## Initial Configuration</div><div id="bkmrk-%23%23%23-services">\### Services</div><div id="bkmrk-set-up-switch-servic">Set up switch services.</div><div id="bkmrk-%60%60%60plaintext">```plaintext</div><div id="bkmrk-no-service-pad">no service pad</div><div id="bkmrk-service-tcp-keepaliv">service tcp-keepalives-in</div><div id="bkmrk-service-tcp-keepaliv-1">service tcp-keepalives-out</div><div id="bkmrk-service-timestamps-d">service timestamps debug datetime msec localtime show-timezone</div><div id="bkmrk-service-timestamps-l">service timestamps log datetime msec localtime show-timezone</div><div id="bkmrk-service-password-enc">service password-encryption</div><div id="bkmrk-service-sequence-num">service sequence-numbers</div><div id="bkmrk-%60%60%60">```</div><div id="bkmrk-%23%23%23-hostname">\### Hostname</div><div id="bkmrk-set-the-hostname-of-">Set the hostname of the switch.</div><div id="bkmrk-%60%60%60plaintext-1">```plaintext</div><div id="bkmrk-hostname-hostname">hostname Hostname</div><div id="bkmrk-%60%60%60-1">```</div><div id="bkmrk-%23%23%23-logging">\### Logging</div><div id="bkmrk-set-up-logging.">Set up logging.</div><div id="bkmrk-%60%60%60plaintext-2">```plaintext</div><div id="bkmrk-logging-file-flash%3Al">logging file flash:LOG_SWITCH8 89999 notifications</div><div id="bkmrk-logging-count">logging count</div><div id="bkmrk-logging-buffered-160">logging buffered 16000</div><div id="bkmrk-logging-console-crit">logging console critical</div><div id="bkmrk-no-logging-monitor">no logging monitor</div><div id="bkmrk-login-on-failure-log">login on-failure log</div><div id="bkmrk-login-on-success-log">login on-success log</div><div id="bkmrk-%60%60%60-2">```</div><div id="bkmrk-%23%23%23-security">\### Security</div><div id="bkmrk-set-the-main-adminis">Set the main administration password.</div><div id="bkmrk-%60%60%60plaintext-3">```plaintext</div><div id="bkmrk-enable-secret-5-%241%241">enable secret 5 $1$17Sv$8ggwbemNPWiYG5OfzyDj10</div><div id="bkmrk-%60%60%60-3">```</div><div id="bkmrk-%23%23%23-users">\### Users</div><div id="bkmrk-set-up-users.">Set up users.</div><div id="bkmrk-%60%60%60plaintext-4">```plaintext</div><div id="bkmrk-username-username-pr">username username privilege 15 secret 5 $1$0OSy$a3Efm134K8B.CiI0FJrT9.</div><div id="bkmrk-username-username2-p">username username2 privilege 15 secret 5 $1$.JaZ$mQGaaM632DVlyAxIkyqxx0</div><div id="bkmrk-%60%60%60-4">```</div><div id="bkmrk-%23%23%23-time-settings">\### Time Settings</div><div id="bkmrk-set-your-time-zone-a">Set your time zone and daylight savings time details.</div><div id="bkmrk-%60%60%60plaintext-5">```plaintext</div><div id="bkmrk-no-aaa-new-model">no aaa new-model</div><div id="bkmrk-clock-timezone-pst--">clock timezone PST -8 0</div><div id="bkmrk-clock-summer-time-ps">clock summer-time PST recurring</div><div id="bkmrk-system-mtu-routing-1">system mtu routing 1500</div><div id="bkmrk-%60%60%60-5">```</div><div id="bkmrk--5">  
</div><div id="bkmrk-%23%23-routing-and-dns">\## Routing and DNS</div><div id="bkmrk-set-the-domain-sourc">Set the domain source and domain name server addresses.</div><div id="bkmrk-%60%60%60plaintext-6">```plaintext</div><div id="bkmrk-no-ip-source-route">no ip source-route</div><div id="bkmrk-ip-routing">ip routing</div><div id="bkmrk-no-ip-gratuitous-arp">no ip gratuitous-arps</div><div id="bkmrk-%21">!</div><div id="bkmrk-ip-domain-list-pacs.">ip domain-list pacs.local.lan</div><div id="bkmrk-ip-domain-lookup-sou">ip domain-lookup source-interface Vlan10</div><div id="bkmrk-ip-domain-name-pacs.">ip domain-name pacs.local.lan</div><div id="bkmrk-ip-name-server-192.1">ip name-server 192.168.0.1</div><div id="bkmrk-ip-name-server-192.1-1">ip name-server 192.168.0.2</div><div id="bkmrk-%60%60%60-6">```</div><div id="bkmrk--6">  
</div><div id="bkmrk-%23%23-spanning-tree-set">\## Spanning-tree settings</div><div id="bkmrk-set-the-spanning-tre">Set the spanning-tree portfast settings.</div><div id="bkmrk-%60%60%60plaintext-7">```plaintext</div><div id="bkmrk-spanning-tree-mode-p">spanning-tree mode pvst</div><div id="bkmrk-spanning-tree-portfa">spanning-tree portfast edge default</div><div id="bkmrk-spanning-tree-portfa-1">spanning-tree portfast edge bpduguard default</div><div id="bkmrk-spanning-tree-portfa-2">spanning-tree portfast edge bpdufilter default</div><div id="bkmrk-spanning-tree-extend">spanning-tree extend system-id</div><div id="bkmrk-%21-1">!</div><div id="bkmrk-vlan-internal-alloca">vlan internal allocation policy ascending</div><div id="bkmrk-no-cdp-run">no cdp run</div><div id="bkmrk-%60%60%60-7">```</div><div id="bkmrk--7">  
</div><div id="bkmrk-%23%23-ssh-access">\## SSH Access</div><div id="bkmrk-set-up-ssh-access.">Set up SSH access.</div><div id="bkmrk-%60%60%60plaintext-8">```plaintext</div><div id="bkmrk-ip-forward-protocol-">ip forward-protocol nd</div><div id="bkmrk-%21-2">!</div><div id="bkmrk-no-ip-http-server">no ip http server</div><div id="bkmrk-no-ip-http-secure-se">no ip http secure-server</div><div id="bkmrk-ip-tftp-source-inter">ip tftp source-interface Loopback0</div><div id="bkmrk-ip-ssh-time-out-60">ip ssh time-out 60</div><div id="bkmrk-ip-ssh-version-2">ip ssh version 2</div><div id="bkmrk-ip-scp-server-enable">ip scp server enable</div><div id="bkmrk-%60%60%60-8">```</div><div id="bkmrk--8">  
</div><div id="bkmrk-%23%23-access-list">\## Access List</div><div id="bkmrk-set-up-the-access-li">Set up the access list to limit device access to the shell interface. Include administration end points as IP addresses, one per line. IP addresses not listed will be denied access.</div><div id="bkmrk-%60%60%60plaintext-9">```plaintext</div><div id="bkmrk-logging-facility-loc">logging facility local1</div><div id="bkmrk-logging-source-inter">logging source-interface Vlan10</div><div id="bkmrk-access-list-38-remar">access-list 38 remark *** Permitted Access Sources ***</div><div id="bkmrk-access-list-38-permi">access-list 38 permit 192.168.0.100</div><div id="bkmrk-access-list-38-permi-1">access-list 38 permit 192.168.0.101</div><div id="bkmrk-%60%60%60-9">```</div><div id="bkmrk--9">  
</div><div id="bkmrk-%23%23-warning-banner">\## Warning Banner</div><div id="bkmrk-set-up-the-motd-logi">Set up the MOTD login working banner by following the terminal prompts and copy pasting as needed from the code below.</div><div id="bkmrk-%60%60%60plaintext-10">```plaintext</div><div id="bkmrk-banner-login%C2%A0">banner login </div><div id="bkmrk-%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D">================================================================================</div><div id="bkmrk-_%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0-%C2%A0">_ **WARNING TO USERS OF THIS SYSTEM**</div><div id="bkmrk-_">_</div><div id="bkmrk-this-computer-system">This computer system, including all related equipment, networks, and network</div><div id="bkmrk-devices%2C-is-provided">devices, is provided by [entity or business name] in accordance with</div><div id="bkmrk-the-policy-for-offic">the policy for official use and limited personal use. This system may not</div><div id="bkmrk-be-connected-to-the-">be connected to the Internet, in any way, unless specifically authorized by the</div><div id="bkmrk-%5Bauthorizing-individ">[authorizing individual or entity].</div><div id="bkmrk-_-1">_</div><div id="bkmrk-all-computer-systems">All computer systems may be monitored for all lawful purposes, including</div><div id="bkmrk-but-not-limited-to%2C-">but not limited to, ensuring that use is authorized, for management of the</div><div id="bkmrk-system%2C-to-facilitat">system, to facilitate protection against unauthorized access, and to verify</div><div id="bkmrk-security-procedures%2C">security procedures, survivability and operational security. Any information on</div><div id="bkmrk-this-computer-system-1">this computer system may be examined, recorded, copied and used for authorized</div><div id="bkmrk-purposes-at-any-time">purposes at any time. All information, including personal information, placed or</div><div id="bkmrk-sent-over-this-syste">sent over this system may be monitored, and users of this system are reminded</div><div id="bkmrk-that-such-monitoring">that such monitoring does occur. Therefore, there should be no expectation of</div><div id="bkmrk-privacy-with-respect">privacy with respect to use of this system.</div><div id="bkmrk-_-2">_</div><div id="bkmrk-by-logging-into-this">By logging into this computer system, you acknowledge and consent to the</div><div id="bkmrk-monitoring-of-this-s">monitoring of this system. Evidence of your use, authorized or unauthorized,</div><div id="bkmrk-collected-during-mon">collected during monitoring may be used for civil, criminal, administrative, or</div><div id="bkmrk-other-adverse-action">other adverse action. Unauthorized or illegal use may subject you to</div><div id="bkmrk-prosecution.">prosecution.</div><div id="bkmrk-_-3">_</div><div id="bkmrk-%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D-1">================================================================================</div><div id="bkmrk-%60%60%60-10">```</div><div id="bkmrk--10">  
</div><div id="bkmrk-%23%23-transport-and-mon">\## Transport and Monitoring</div><div id="bkmrk--11">  
</div><div id="bkmrk-%23%23%23-transport">\### Transport</div><div id="bkmrk-set-up-transport.">Set up transport.</div><div id="bkmrk-%60%60%60plaintext-11">```plaintext</div><div id="bkmrk-line-con-0">line con 0</div><div id="bkmrk-%C2%A0exec-timeout-15-0"> exec-timeout 15 0</div><div id="bkmrk-%C2%A0logging-synchronous"> logging synchronous</div><div id="bkmrk-%C2%A0login-local"> login local</div><div id="bkmrk-line-vty-0-4">line vty 0 4</div><div id="bkmrk-%C2%A0access-class-38-in"> access-class 38 in</div><div id="bkmrk-%C2%A0exec-timeout-9-0"> exec-timeout 9 0</div><div id="bkmrk-%C2%A0logging-synchronous-1"> logging synchronous</div><div id="bkmrk-%C2%A0login-local-1"> login local</div><div id="bkmrk-%C2%A0transport-input-ssh"> transport input ssh</div><div id="bkmrk-%C2%A0transport-output-ss"> transport output ssh</div><div id="bkmrk-line-vty-5-15">line vty 5 15</div><div id="bkmrk-%C2%A0access-class-38-in-1"> access-class 38 in</div><div id="bkmrk-%C2%A0exec-timeout-9-0-1"> exec-timeout 9 0</div><div id="bkmrk-%C2%A0logging-synchronous-2"> logging synchronous</div><div id="bkmrk-%C2%A0login-local-2"> login local</div><div id="bkmrk-%C2%A0transport-input-ssh-1"> transport input ssh</div><div id="bkmrk-%C2%A0transport-output-ss-1"> transport output ssh</div><div id="bkmrk-%60%60%60-11">```</div><div id="bkmrk--12">  
</div><div id="bkmrk-%23%23%23-monitoring">\### Monitoring</div><div id="bkmrk-set-up-session-vlan-">Set up session-vlan monitoring.</div><div id="bkmrk-%60%60%60plaintext-12">```plaintext</div><div id="bkmrk-monitor-session-10-s">monitor session 10 source vlan 10</div><div id="bkmrk-scheduler-interval-5">scheduler interval 500</div><div id="bkmrk-%60%60%60-12">```</div><div id="bkmrk--13">  
</div><div id="bkmrk-%23%23-interface-configu">\## Interface Configuration</div><div id="bkmrk--14">  
</div><div id="bkmrk-%23%23%23-loopback-interfa">\### Loopback Interface</div><div id="bkmrk-set-up-the-loopback-">Set up the loopback interface.</div><div id="bkmrk-%60%60%60plaintext-13">```plaintext</div><div id="bkmrk-interface-loopback0">interface Loopback0</div><div id="bkmrk-%C2%A0no-ip-address"> no ip address</div><div id="bkmrk-%60%60%60-13">```</div><div id="bkmrk--15">  
</div><div id="bkmrk-%23%23%23-vlans">\### Vlans</div><div id="bkmrk-set-up-the-vlans-to-">Set up the Vlans to be used. Alter for your environment and device.</div><div id="bkmrk-%60%60%60plaintext-14">```plaintext</div><div id="bkmrk-%21-3">!</div><div id="bkmrk-interface-vlan1">interface Vlan1</div><div id="bkmrk-%C2%A0description-do-not-"> description Do not use</div><div id="bkmrk-%C2%A0no-ip-address-1"> no ip address</div><div id="bkmrk-%C2%A0shutdown"> shutdown</div><div id="bkmrk-%21-4">!</div><div id="bkmrk-interface-vlan10">interface Vlan10</div><div id="bkmrk-%C2%A0description-%2A%2A%2A-pac"> description *** PACS Switch ***</div><div id="bkmrk-%C2%A0ip-address-192.168."> ip address 192.168.0.8 255.255.255.0</div><div id="bkmrk-%C2%A0no-ip-redirects"> no ip redirects</div><div id="bkmrk-%C2%A0no-ip-unreachables"> no ip unreachables</div><div id="bkmrk-%C2%A0no-ip-proxy-arp"> no ip proxy-arp</div><div id="bkmrk-%21-5">!</div><div id="bkmrk-interface-vlan666">interface Vlan666</div><div id="bkmrk-%C2%A0description-switch-"> description SWITCH LAN</div><div id="bkmrk-%C2%A0ip-address-10.0.0.8"> ip address 10.0.0.8 255.255.255.0</div><div id="bkmrk-%C2%A0no-ip-unreachables-1"> no ip unreachables</div><div id="bkmrk-%60%60%60-14">```</div><div id="bkmrk--16">  
</div><div id="bkmrk-%23%23-interface-securit">\## Interface Security Configuration Settings</div><div id="bkmrk--17">  
</div><div id="bkmrk-set-up-each-interfac">Set up each interface to either be shutdown (if no connection is expected), connected with macsticky security, trunk to another local switch or trunk to a remote switch using macsec encryption.</div><div id="bkmrk--18">  
</div><div id="bkmrk-%23%23%23-unconnected-inte">\### Unconnected Interface</div><div id="bkmrk-%60%60%60plaintext-15">```plaintext</div><div id="bkmrk-interface-gigabiteth">interface GigabitEthernetX/X/X</div><div id="bkmrk-%C2%A0switchport-access-v"> switchport access vlan 256</div><div id="bkmrk-%C2%A0switchport-mode-acc"> switchport mode access</div><div id="bkmrk-%C2%A0shutdown-1"> shutdown</div><div id="bkmrk-%60%60%60-15">```</div><div id="bkmrk--19">  
</div><div id="bkmrk-%23%23%23-connected-interf">\### Connected Interface with Macsticky</div><div id="bkmrk-%60%60%60plaintext-16">```plaintext</div><div id="bkmrk-interface-gigabiteth-1">interface GigabitEthernetX/X/X</div><div id="bkmrk-%C2%A0description-your-de"> description YOUR-DESCRIPTION</div><div id="bkmrk-%C2%A0switchport-access-v-1"> switchport access vlan 10</div><div id="bkmrk-%C2%A0switchport-mode-acc-1"> switchport mode access</div><div id="bkmrk-%C2%A0switchport-port-sec"> switchport port-security</div><div id="bkmrk-%C2%A0switchport-port-sec-1"> switchport port-security violation restrict</div><div id="bkmrk-%C2%A0switchport-port-sec-2"> switchport port-security mac-address sticky</div><div id="bkmrk-%C2%A0spanning-tree-bpdug"> spanning-tree bpduguard enable</div><div id="bkmrk-%60%60%60-16">```</div><div id="bkmrk--20">  
</div><div id="bkmrk-%23%23%23-connected-local-">\### Connected Local Trunk Port (No MACsec)</div><div id="bkmrk-%60%60%60plaintext-17">```plaintext</div><div id="bkmrk-interface-gigabiteth-2">interface GigabitEthernet0/11</div><div id="bkmrk-%C2%A0description-uplink-"> description UPLINK to SWITCH_HOST_NAME</div><div id="bkmrk-%C2%A0switchport-trunk-al"> switchport trunk allowed vlan 10</div><div id="bkmrk-%C2%A0switchport-trunk-na"> switchport trunk native vlan 10</div><div id="bkmrk-%C2%A0switchport-mode-tru"> switchport mode trunk</div><div id="bkmrk-%C2%A0no-cdp-enable"> no cdp enable</div><div id="bkmrk-%C2%A0spanning-tree-portf"> spanning-tree portfast disable</div><div id="bkmrk-%60%60%60-17">```</div><div id="bkmrk--21">  
</div><div id="bkmrk-%23%23%23-connected-remote">\### Connected Remote Trunk Port (MACsec)</div><div id="bkmrk-%60%60%60plaintext-18">```plaintext</div><div id="bkmrk-interface-gigabiteth-3">interface GigabitEthernetx/x/xx</div><div id="bkmrk-%C2%A0description-test-ma"> description test macsec</div><div id="bkmrk-%C2%A0switchport-mode-tru-1"> switchport mode trunk</div><div id="bkmrk-%C2%A0macsec-network-link"> macsec network-link</div><div id="bkmrk-%C2%A0mka-policy-mka_128"> mka policy MKA_128</div><div id="bkmrk-%C2%A0mka-pre-shared-key-"> mka pre-shared-key key-chain KC_128</div><div id="bkmrk-%60%60%60-18">```</div><div id="bkmrk--22">  
</div><div id="bkmrk-%23%23-cisco-macsec-conf">\## Cisco MACsec Configuration</div><div id="bkmrk--23">  
</div><div id="bkmrk-%23%23%23-cisco-9300-main-">\### Cisco 9300 Main Configuration MACsec Code</div><div id="bkmrk-%60%60%60plaintext-19">```plaintext</div><div id="bkmrk-key-chain-kc_128-mac">key chain KC_128 macsec</div><div id="bkmrk-%C2%A0key-12"> key 12</div><div id="bkmrk-%C2%A0-%C2%A0cryptographic-alg"> cryptographic-algorithm aes-128-cmac</div><div id="bkmrk-%C2%A0-key-string-7-014a5"> key-string 7 014A5651035F5F5677146F584B5143345328567C0F73786364044A21375257700F</div><div id="bkmrk-%60%60%60-19">```</div><div id="bkmrk--24">  
</div><div id="bkmrk-%23%23%23-cisco-9300-inter">\### Cisco 9300 Interface MACsec Code</div><div id="bkmrk-%60%60%60plaintext-20">```plaintext</div><div id="bkmrk-interface-gigabiteth-4">interface GigabitEthernet1/1/1</div><div id="bkmrk-%C2%A0description-uplink--1"> description UPLINK to KESWICK70</div><div id="bkmrk-%C2%A0switchport-trunk-na-1"> switchport trunk native vlan 10</div><div id="bkmrk-%C2%A0switchport-trunk-al-1"> switchport trunk allowed vlan 10</div><div id="bkmrk-%C2%A0switchport-mode-tru-2"> switchport mode trunk</div><div id="bkmrk-%C2%A0no-cdp-enable-1"> no cdp enable</div><div id="bkmrk-%C2%A0macsec-network-link-1"> macsec network-link</div><div id="bkmrk-%C2%A0mka-policy-mka_128-1"> mka policy MKA_128</div><div id="bkmrk-%C2%A0mka-pre-shared-key--1"> mka pre-shared-key key-chain KC_128</div><div id="bkmrk-%C2%A0spanning-tree-portf-1"> spanning-tree portfast disable</div><div id="bkmrk-%60%60%60-20">```</div><div id="bkmrk--25">  
</div><div id="bkmrk-%23%23%23-cisco-3650-main-">\### Cisco 3650 Main Configuration MACsec Code</div><div id="bkmrk-%60%60%60plaintext-21">```plaintext</div><div id="bkmrk-key-chain-kc_128-mac-1">key chain KC_128 macsec</div><div id="bkmrk-key-3c1337fcdcb631a3">key 3C1337FCDCB631A33207210A261AED0C</div><div id="bkmrk-cryptographic-algori">cryptographic-algorithm aes-128-cmac</div><div id="bkmrk-key-string-7-3c1337f">key-string 7 3c1337fcdcb631a33207210a261aed0c</div><div id="bkmrk-%60%60%60-21">```</div><div id="bkmrk--26">  
</div><div id="bkmrk-%23%23%23-cisco-3650-inter">\### Cisco 3650 Interface MACsec Code</div><div id="bkmrk-%60%60%60plaintext-22">```plaintext</div><div id="bkmrk-interface-gigabiteth-5">interface GigabitEthernetx/x/xx</div><div id="bkmrk-%C2%A0description-test-ma-1"> description test macsec</div><div id="bkmrk-%C2%A0switchport-mode-tru-3"> switchport mode trunk</div><div id="bkmrk-%C2%A0macsec-network-link-2"> macsec network-link</div><div id="bkmrk-%C2%A0mka-policy-mka_128-2"> mka policy MKA_128</div><div id="bkmrk-%C2%A0mka-pre-shared-key--2"> mka pre-shared-key key-chain KC_128</div><div id="bkmrk-%60%60%60-22">```</div>